The Users Authentication And Private Keys Distribution Scheme Of Identity Based Encryption System

Identity based Encryption, which is usually called IBE for short is a kind of public key encryption scheme. Compare with Public key Infrastructure (PKI), IBE uses user's identity to generate public keys and private keys. When someone wants to send encrypted messages to another, he doesn't need the other's public key certificate, instead of which, he can use his identity (for example, his Email, telephone number, etc) to encrypt the message. This is a good solution to the problem of dependence on public key certificate in traditional public key scheme, and it relieves the pressure of certificate center a lot, as a result, it improves the performance of the whole system. Meanwhile, each user's private key is generated by the master key of the system and different keys can be got by verifying the ID (for example, Email + department, Email + position, Email + date in which Email is the basic ID.), these features let IBE can update all the private keys in the system and grant each user more detailed privileges in an easy way, for example Email + department can limit the department of the user, Email + position can limit the position and Email + date can make sure the valid time limit of the private key, and these limitation can be used in compound ways to limit the users privileges in more detailed ways in order to have higher security level.Because of these features, IBE can be a good complementation to PKI. Since it had been proposed by 1984, it had lot of schemes, until 2001, Boneh and Franklin proposed a scheme which is based on bilinear pairs on elliptic curves (BF-IBE) which had been proved by strict rules. The progress of IBE has never been stopped. However, there are problems on IBE schemes, for example, the reliability of PKG, as we can see, each user's private key is generated by the master key, so if the PKG which stores the master key has unreliability actions, the whole system's security will be in dangerous condition; The problem of private key revocation, in IBE scheme, if one user wants to update his private key as if he has lost his private key, because of the features of this encryption system, there are only two ways to accomplish this, the user changes his ID or the system changes the master key to replace everyone's private key in this system, but both these two ways are not good enough; The problem of users'authentication to PKG and how the PKG can distribute the private key to user in a safe way. In the IBE scheme, the user doesn't have to store his private key in theoretical, when he gets an encrypted message, he authenticates himself to the PKG and gets his private key from it to decrypt the message, however, in this situation, it is difficult for him to authenticate to the PKG. In this paper, the third problem is selected to be researched and two schemes are proposed to resolve it.In this paper, a local registration center has been added on the IBE system prototype which is used to authenticate user's identity by offline ways, and generate information which is stored by system and users'authenticate information which is stored by user himself. Besides, we propose two schemes: One is based on the feature that the PKG has its master key to generate users'private keys, we suppose the user also has a master key, and in this situation, the user can also generate public parameters to share with the PKG, by which the user can authenticate himself to the PKG and the PKG also can distribute private key to him safely. Based on this idea, in the paper some part of IBE algorithm prototype has been modified, the user's master key and random number have been added which can let user authenticate himself to PKG by his master key, random number and the information stored by the PKG. The detailed steps of how user can make his authentication have been describe in the paper and finally the security proof has been given; the other scheme is based on the idea of symmetrical encryption authentication, as in the IBE system, the PKG can have each user's private key, which means the user and the PKG can have the same private key at the same time, it leads to the possibility for the user to authenticate his identity by the hash code of his private key. First of all, the user encrypts the hash code of his private key by a symmetrical key and then uses the PKG's ID to encrypt the symmetrical key, then sends them to the PKG. The PKG receives the message and decrypt it by his private key to have the user's private key hash code, and then the PKG generate the user's private key and calculates its hash code in order to make a comparison, if the user's private key hash code is equal to the one generated by the PKG, the user's identity is successfully authenticated. Finally, the PKG use the symmetrical key to encrypt the private key and distribute it. The detail steps have also been given and the security improvement has been proved too.At last, based on the second scheme, the user's authentication module and private key distribution module have been added on the IBE system prototype. The relationships of different modules have been described, and a serial of flow charts describe the implementation flow of the user's authentication and private key distribution. On the other hand, several algorithms such as random number's generation, the hash code implementation and the calculation of points on elliptic curves also have been given, and these algorithms make it possible to implement the system.In this paper, IBE scheme has been discussed and several problems have been pointed out. Besides, user's authentication and private key's distribution problem have been researched and new schemes have been proposed. These schemes are applicable to BF-IBE which solves the problem of IBE system prototype, and meanwhile, it makes new references to the improvement of IBE schemes. After this, an implementation of the scheme proposed in this paper is described which proved the useable of the new scheme.